Two young men face possible jail terms for a cyberattack on Transport for London after changing their pleas to guilty ahead of a planned trial.

Thalha Jubair, 20, and Owen Flowers, 18, admitted conspiring to carry out unauthorised acts against TfL’s network between 29 August and 6 September 2024. Prosecutors said the attack caused a £39 million loss. Their sentencing hearing is due to begin on Wednesday at Woolwich Crown Court.

The National Crime Agency said the breach forced around 28,000 TfL employees to visit an office to reset their passwords. Data from the Oyster refund system was accessed, some refunds were delayed, and applications for children’s and young people’s Oyster photocards were suspended. The agency identified both men as members of the hacking group Scattered Spider.

Flowers, from Walsall, also admitted offences involving two US healthcare organisations. Jubair is from Tower Hamlets in east London.